				XUNPACK

Ever wanted to debug/step through a packed program ? Quite painful since the
stored program does not contain the final memory image, but a preamble that
unpacks it at run-time.

Unfortunately, there is no standard utility to unpack such a program. More,
there are third-party packers that implement alternative compression methods,
and even Micro$oft's EXEPACK and linker use different methods depending on the
version.

XUNPACK attempts to be an "universal" unpacker by exploiting a common
characteristic of most of the run-time unpacking algorithm code: the
unpacker moves itself above the final program space then jumps to the
segment of the moved code; it then unpacks the target program and performs
another inter-segment jump to the final start address. As no other
inter-segment jump occurs while unpacking, the memory contains the unpacked
program whenever the second inter-segment occurs.

XUNPACK steps through the unpacker code by only using instructions
emulation and stepping vector, so it can even be executed on processors
that do not support virtual modes.

This operation is performed twice at different memory segments: this
allows detecting relocations and unchanged location by comparing both
passes' results. An unpacked equivalent program is then written to disk.


Usage:

xunpack [-b] [-s] [-t <temp dir>] [-o <output file>] progfile <args>
  -b    Trailing data are byte-aligned.
        A target program can contain trailing data (such as resources, etc.):
        this flag controls whether these data are aligned on a 512-byte page
        page boundary (default) or not.
  -s    Do not show progress indicator.
  -o    Name output executable file
  -t    Directory for temporary file (default: $TMP, $TEMP or '.').


XUNPACK may fail if the expected unpacker code characteristics are not met
(invalid instruction, system call, etc.). It can even crash if what is
expected to be the unpacker code destroys the trace vector.
